110366 - Trunk crash [@ 0x00000001 | 0x00000000 - nsStorageTransport::AsyncRead]

Status: VERIFIED FIXED

(Core :: Networking: Cache, defect)

Description

[Jay Patel [:jay]]

This seems to be a Windows 2000 (possibly Windows XP) specific crash.  Talkback
data shows the OS as Windows NT  5.0 build 2195, which I believe is Win2k. 
Shiva, can you check on that?

It is also a topcrasher with recent MozillaTrunk builds.  There appears to be 3
distinct stack traces for this stack signature:

Incident ID 38014581
0x00000001
nsStorageTransport::AsyncRead
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStorageTransport.cpp, line 383]
nsCacheEntryDescriptor::nsTransportWrapper::AsyncRead
[d:\builds\seamonkey\mozilla\netwerk\cache\src\nsCacheEntryDescriptor.cpp, line 561]
nsImapMockChannel::ReadFromMemCache
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapProtocol.cpp, line 7074]
nsImapMockChannel::OnCacheEntryAvailable
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapProtocol.cpp, line 7018]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 154]
EventHandler [d:\builds\seamonkey\mozilla\xpcom\proxy\src\nsProxyEvent.cpp, line
515]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 303]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1316]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1633]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1651]
WinMainCRTStartup()
KERNEL32.DLL + 0x192a6 (0x77e992a6) 


Incident ID 38000673
0x00000001
nsStorageTransport::AsyncRead
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStorageTransport.cpp, line 383]
nsCacheEntryDescriptor::nsTransportWrapper::AsyncRead
[d:\builds\seamonkey\mozilla\netwerk\cache\src\nsCacheEntryDescriptor.cpp, line 561]
nsNNTPProtocol::ReadFromMemCache
[d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp, line 782]
nsNNTPProtocol::OnCacheEntryAvailable
[d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp, line 888]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 154]
EventHandler [d:\builds\seamonkey\mozilla\xpcom\proxy\src\nsProxyEvent.cpp, line
515]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 303]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1316]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1633]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1651]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

and

Incident ID 37967896
0x00000001
nsStorageTransport::AsyncRead
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStorageTransport.cpp, line 383]
nsCacheEntryDescriptor::nsTransportWrapper::AsyncRead
[d:\builds\seamonkey\mozilla\netwerk\cache\src\nsCacheEntryDescriptor.cpp, line 561]
nsHttpChannel::ReadFromCache
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 978]
nsHttpChannel::ProcessNotModified
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 624]
nsHttpChannel::ProcessResponse
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 522]
nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 126]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 303]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1316]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1633]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1651]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Here are all the user comments:

(38031518)
URL: http://www.del.dennon.com
(38031518)
Comments: I just tried to read a message via IMAP and it crashed
     (38017767)	Comments: Crashed after turning thread view off and on in a few folders
     (38014581)	Comments: Clicking on messages headers in my mail pane.  I use imap over ssl.
     (38001447)	Comments: accessing IMAP mail
     (37999914)	Comments: Previewing a mail message in Messenger
     (37995250)	URL: www.eclipse.org - newsgroups web interface
     (37995250)	Comments: Opening e-mail whilst logging in to HTTP authenticated site
     (37969528)	Comments: deleting mail
     (37967896)	Comments: Accessing an Apache SSL webserver using Java Applets (via HTTPS)1.
Site sets session cookie2. Browser launches Java JVM (1.3.1) by requesting a
Java applet3. Java applet is used4. Logout of site deletes session cookie5.
Attempt to log back in
     (37967896)	Comments:  to use applets6. Browser crashes and burns....hard
     (37930552)	Comments: trying to open a mail message
     (37915989)	Comments: Was trying to "remove all expired articles" from a newsgroup and
Moz crashed
     (37914624)	Comments: reading newsgroup message
     (37913971)	URL: http://bigbrother.dk
(37913971)
Comments: reading news
     (37900876)	Comments: Browsing news.mozilla.org  clicked a message after error "too many
connections"

Comment 1

[Jay Patel [:jay]]

Adding 0x00000000 to summary, since this crash is also showing up under that
stack signature.

Comment 2

[gordon]

Darin, any changes recently?

Comment 3

[Darin Fisher]

-> naving ...  guess that change to nsStorageTransport wasn't quite right :(

Comment 4

[Navin Gupta]

accepting

Comment 5

[Navin Gupta]

Attachment: proposed fix

The fix is to make sure we are not done with the read request. Once we are
done, we set mTranport to null, remove request from ReadRequest linked
list(ReadRequestCompleted). If we are done then just bail out. 

darin, please review.

Comment 6

[Navin Gupta]

We have mListenerProxy in nsStorageTransport::nsReadRequest() that is proxy on 
"this". I am wondering if we can destroy mListenerProxy just after OnStopRequest 
in all cases. This is why this crash is happening. If we don't destroy it, then 
nsReadRequest will leak. 

doug, could you suggest something here, thanks.

Comment 7

[Doug Turner (:dougt)]

as along as the proxy to "THIS" isn't the last remaining reference that should
be save.  Also make sure that the nsStorageTransport implements a threadsafe
version of ISupports.

Comment 8

[Navin Gupta]

Actually that proxy holds the last remaining reference to "THIS" which is why this
crash happens. It does implement thread-safe version of nsISupports. 

Comment 9

[Navin Gupta]

Attachment: fix the crash

This will fix the crash but nsReadRequest will leak.

Comment 10

[Darin Fisher]

we need to find a solution that handles both the crash as well as the leak, but
that being said, i'd rather leak than crash :)

naving: perhaps we can look at this together sometime?

Comment 11

[Navin Gupta]

Attachment: proposed fix

Addref the reader so that it is not released from under us. Darin and i came up
with this fix. Doug could you review, thanks

Comment 12

[Darin Fisher]

Comment on attachment 58449 [details] [diff] [review]
proposed fix

r/sr=darin

Comment 13

[Navin Gupta]

fixed

Comment 14

[Jay Patel [:jay]]

verified fixed.  i haven't seen this crash in recent MozillaTrunk data.